Class SecureHeadersGatewayFilterFactory

java.lang.Object

org.springframework.cloud.gateway.support.AbstractConfigurable<SecureHeadersGatewayFilterFactory.Config>

org.springframework.cloud.gateway.filter.factory.AbstractGatewayFilterFactory<SecureHeadersGatewayFilterFactory.Config>

org.springframework.cloud.gateway.filter.factory.SecureHeadersGatewayFilterFactory

All Implemented Interfaces:

org.springframework.beans.factory.Aware, GatewayFilterFactory<SecureHeadersGatewayFilterFactory.Config>, Configurable<SecureHeadersGatewayFilterFactory.Config>, ShortcutConfigurable, org.springframework.context.ApplicationEventPublisherAware

public class SecureHeadersGatewayFilterFactory
extends AbstractGatewayFilterFactory<SecureHeadersGatewayFilterFactory.Config>

GatewayFilterFactory to provide a route filter that applies security headers to the HTTP response. External configuration SecureHeadersProperties provides opinionated defaults. Following the recommendations made in Http-Security-Headers. When opt-out headers are not disabled or explicitly configured, sensible defaults are applied. Additionally, opt-in headers, such as Permissions-Policy, may be applied.

Author:

Spencer Gibb, Thirunavukkarasu Ravichandran, Jörg Richter

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	SecureHeadersGatewayFilterFactory.Config	POJO for SecureHeadersGatewayFilterFactory filter configuration.

Nested classes/interfaces inherited from class AbstractGatewayFilterFactory

AbstractGatewayFilterFactory.NameConfig

Nested classes/interfaces inherited from interface ShortcutConfigurable

ShortcutConfigurable.GatewayBeanFactoryResolver, ShortcutConfigurable.GatewayEvaluationContext, ShortcutConfigurable.RestrictivePropertyAccessor, ShortcutConfigurable.ShortcutType

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CONTENT_SECURITY_POLICY_HEADER	Content-Security Policy header name.
static final String	REFERRER_POLICY_HEADER	Referrer Policy header name.
static final String	STRICT_TRANSPORT_SECURITY_HEADER	Strict transport security header name.
static final String	X_CONTENT_TYPE_OPTIONS_HEADER	Content-Type Options header name.
static final String	X_DOWNLOAD_OPTIONS_HEADER	Download Options header name.
static final String	X_FRAME_OPTIONS_HEADER	Frame options header name.
static final String	X_PERMITTED_CROSS_DOMAIN_POLICIES_HEADER	Permitted Cross-Domain Policies header name.
static final String	X_XSS_PROTECTION_HEADER	Xss-Protection header name.

Fields inherited from interface GatewayFilterFactory

NAME_KEY, VALUE_KEY

Constructor Summary

Constructors

Constructor	Description
SecureHeadersGatewayFilterFactory(SecureHeadersProperties properties)

Method Summary

Modifier and Type	Method	Description
GatewayFilter	apply(SecureHeadersGatewayFilterFactory.Config originalConfig)	Returns a GatewayFilter that applies security headers to the HTTP response.

Methods inherited from class AbstractGatewayFilterFactory

enableBodyCaching, getPublisher, setApplicationEventPublisher

Methods inherited from class AbstractConfigurable

getConfigClass, newConfig, toString

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface GatewayFilterFactory

apply, apply, apply, getConfigClass, name, newConfig

Methods inherited from interface ShortcutConfigurable

shortcutFieldOrder, shortcutFieldPrefix, shortcutType

Field Details

X_XSS_PROTECTION_HEADER

public static final String X_XSS_PROTECTION_HEADER

Xss-Protection header name.

See Also:

• Constant Field Values

STRICT_TRANSPORT_SECURITY_HEADER

public static final String STRICT_TRANSPORT_SECURITY_HEADER

Strict transport security header name.

See Also:

• Constant Field Values

X_FRAME_OPTIONS_HEADER

public static final String X_FRAME_OPTIONS_HEADER

Frame options header name.

See Also:

• Constant Field Values

X_CONTENT_TYPE_OPTIONS_HEADER

public static final String X_CONTENT_TYPE_OPTIONS_HEADER

Content-Type Options header name.

See Also:

• Constant Field Values

REFERRER_POLICY_HEADER

public static final String REFERRER_POLICY_HEADER

Referrer Policy header name.

See Also:

• Constant Field Values

CONTENT_SECURITY_POLICY_HEADER

public static final String CONTENT_SECURITY_POLICY_HEADER

Content-Security Policy header name.

See Also:

• Constant Field Values

X_DOWNLOAD_OPTIONS_HEADER

public static final String X_DOWNLOAD_OPTIONS_HEADER

Download Options header name.

See Also:

• Constant Field Values

X_PERMITTED_CROSS_DOMAIN_POLICIES_HEADER

public static final String X_PERMITTED_CROSS_DOMAIN_POLICIES_HEADER

Permitted Cross-Domain Policies header name.

See Also:

• Constant Field Values

Constructor Details

SecureHeadersGatewayFilterFactory

public SecureHeadersGatewayFilterFactory(SecureHeadersProperties properties)

Method Details

apply

public GatewayFilter apply(SecureHeadersGatewayFilterFactory.Config originalConfig)

Returns a GatewayFilter that applies security headers to the HTTP response.

Parameters:

originalConfig - the original security configuration

Returns:

a GatewayFilter instance that applies security headers to the HTTP response